Swift Performance Lite Vulnerabilities

The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those f...

CVSS:

8.1

Affected:

up to 2.3.7.1

Fixed in:

2.3.7.2

Disclosed:

Dec 5, 2024

CVE-2024-10516 on NVD →

The Swift Performance Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.6.20. This is due to missing or incorrect nonce validation on the navigate() function. This makes it possible for unauthenticated attackers to activate a plugin and dismiss an admin notice v...

CVSS:

4.3

Affected:

up to 2.3.6.20

Fixed in:

2.3.6.21

Disclosed:

Jul 5, 2024

CVE-2024-37511 on NVD →

The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify setting...

CVSS:

5.4

Affected:

up to 2.3.6.18

Fixed in:

2.3.6.19

Disclosed:

May 8, 2024

CVE-2024-3722 on NVD →

The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admin_init function in all versions up to, and including, 2.3.6.14. This makes it possible for unauthenticated attackers to export the settings of the plugin...

CVSS:

5.3

Affected:

up to 2.3.6.14

Fixed in:

2.3.6.15

Disclosed:

Nov 27, 2023

CVE-2023-6289 on NVD →